sigrank 1.0.46 → 1.0.48

package/resources/privacy-model.md

@@ -19,14 +19,14 @@ It does not persist that content or send it to the SigRank service; it appends
 only provider-reported token counts, model/backend metadata, and timestamps to
 `~/.sigrank-mcp/proxy-sessions.jsonl`.
 
-- **Signed path** (`submit_verified`, `watch_tokenpull` with `submit:true`): the four numbers travel with the device's public key, codename, window, and an ed25519 signature. The board verifies the signature without seeing your data.
-- **Paste path** (`submit_paste`, `tokenpull_submit`): the MCP parses your pasted token counts locally, then sends only the four canonical numbers to the server's web-paste endpoint. Even if you paste mixed text (prose + numbers), only the extracted token counts are transmitted — the raw text never leaves your machine.
+- **Signed path** (`submit_verified`, `watch_tokenpull` with `submit:true`; both require `confirm:true`, so nothing publishes without your approval): the four numbers travel with the device's public key, codename, window, and an ed25519 signature. The board verifies the signature without seeing your data.
+- **Preview tools** (`submit_paste`, `tokenpull_submit`): compute your cascade locally and send nothing. They do not publish to the board; publishing goes through the signed path or the signalaf.com web UI.
 
 ## How it works
 
 1. **Local-first:** All token pulling happens on your machine. Upsilon reads usage metadata from session logs in ~/.claude, ~/.codex, ~/.local/share/amp, etc. The optional proxy also runs only on loopback and only when manually started.
-2. **Token-only persistence:** Local-log adapters extract integer counts from log metadata without reading conversation content. The optional proxy forwards request/response bytes transiently but persists only usage metadata. On the paste path, the MCP parses the paste locally and sends only the four extracted numbers — the raw paste text stays on your machine.
-3. **Signed submission:** Ranked submissions (`submit_verified`, `watch_tokenpull` with `submit:true`) are ed25519-signed with a device-bound key generated locally at enrollment. The board verifies the signature without seeing your data. Paste submissions (`submit_paste`, `tokenpull_submit`) are unsigned and go through the web-paste endpoint with a codename only — but still send only the four token counts, not the raw paste.
+2. **Token-only persistence:** Local-log adapters extract integer counts from log metadata without reading conversation content. The optional proxy forwards request/response bytes transiently but persists only usage metadata. Paste parsing (`submit_paste`, `rank_paste`) happens locally and nothing is transmitted.
+3. **Signed submission:** Ranked submissions (`submit_verified`, `watch_tokenpull` with `submit:true`) are ed25519-signed with a device-bound key generated locally at enrollment. The board verifies the signature without seeing your data. `submit_paste` and `tokenpull_submit` are preview-only and never submit.
 4. **Read tools need no auth:** No API keys, no OAuth, no account needed to read the leaderboard or operator profiles. **Enrollment requires a connect code** from signalaf.com → Settings → New key (the code binds your device's public key to your operator server-side); a codename alone is not enough for the signed/ranked path.
 
 ## What the Upsilon service can NOT see

package/tools/watch-tokenpull.mjs

@@ -17,7 +17,7 @@ import {
 export const TOOL_DEF = {
   name: "watch_tokenpull",
   description:
-    "One poll per call: pulls your local token logs and returns the current cascade for the watched window — the tool never blocks or loops. Re-call at your desired cadence to watch for changes (interval_s is advisory only and echoed back as poll_interval_s). With submit:true (and an enrolled device) each call may also sign + publish the watched window to the board, rate-limited to once per 5 min per platform+window; default is preview-only (no submit).",
+    "One poll per call: pulls your local token logs and returns the current cascade for the watched window — the tool never blocks or loops. Re-call at your desired cadence to watch for changes (interval_s is advisory only and echoed back as poll_interval_s). With submit:true AND confirm:true (and an enrolled device) each call may also sign + publish the watched window to the public board, rate-limited to once per 5 min per platform+window. Publishing requires confirm: true (ask the user first); default is preview-only (no submit).",
   annotations: {
     title: "Watch token pull",
     ...ANNOTATIONS.idempotentHint,
@@ -45,7 +45,12 @@ export const TOOL_DEF = {
       submit: {
         type: "boolean",
         description:
-          "auto-submit the watched window to the board as a VERIFIED operator each poll (requires `enroll`; default false = preview only)",
+          "auto-submit the watched window to the board as a VERIFIED operator each poll (requires `enroll` and confirm:true; default false = preview only)",
+      },
+      confirm: {
+        type: "boolean",
+        description:
+          "REQUIRED with submit:true: must be true, set only after the user has explicitly approved publishing to the public board.",
       },
     },
   },
@@ -78,7 +83,13 @@ export async function handleWatchTokenpull(args, ctx) {
   // watched window to the verified ingest path. Default OFF = preview only. The server
   // dedups identical re-submits (exact snapshot_hash → 422), so re-calling is safe.
   let auth_submit = null;
-  if (args?.submit === true) {
+  if (args?.submit === true && args?.confirm !== true) {
+    auth_submit = {
+      status: "confirmation_required",
+      detail:
+        "watch_tokenpull with submit:true publishes to the public board. Ask the user for approval, then call again with confirm: true.",
+    };
+  } else if (args?.submit === true) {
     const id = ctx.opts.identity || ensureIdentity();
     if (id.codename && id.operator_id && id.private_key_pkcs8_b64) {
       // E3: client-side cooldown — at most one auto-submit per platform+window per 5 min.